SY0-701 Security Program Management and Oversight Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Reply with the codes because the request appears urgent

  Why it's wrong here

  Replying with the codes because the request appears urgent plays directly into the social engineer's script: urgency and authority are pressure cues used to bypass rational thought, not proof of identity. Gift card codes are a classic business email compromise (BEC) indicator, and a legitimate CEO would not route a sensitive request solely through email without an approved secondary method. Responding also confirms to the attacker that the address is active, making future targeted attacks more likely. Instead, the recipient should suspend action and verify through an independent, pre-established channel.

• ✓

  Verify the request through an approved channel and report the message

  Why this is correct

  Verifying the request through an approved channel, such as a pre-configured phone number, in-person contact, or the official ticketing system, confirms authenticity without relying on any contact information found in the suspect email itself. Reporting the message to the security or incident response team allows analysts to collect header data, block the sender, and issue warnings to other employees who may have received identical lures. This combination of independent verification and official reporting directly mitigates the current threat and protects the organization from a likely impersonation fraud. Acting alone, either verification or reporting, is insufficient; both together form a complete and secure response.

• ✗

  Forward the email to coworkers so they can watch for similar messages

  Why it's wrong here

  Forwarding the email to coworkers does not verify the requester's identity and instead spreads the malicious payload or fraudulent instructions to additional inboxes, potentially exposing other employees to phishing or malware. It also bypasses the security team's centralized investigation capability, because coworkers may act on the content, forward it again, or delete it before any analysis can occur. The proper approach is to report a single copy to the incident response team and let them conduct a controlled campaign-wide search and warning process. This prevents the email from becoming a secondary distribution vector while still enabling awareness.

• ✗

  Delete the email and ignore it without telling anyone

  Why it's wrong here

  Deleting the email and ignoring it silently destroys digital evidence that cybersecurity analysts need to identify the attacker's source IP, phishing infrastructure, and campaign fingerprints. The threat remains fully active after deletion: the attacker can reuse the same template, target another employee, or continue sending requests from a different spoofed address, and since no report was filed, no defensive controls or alerts will be updated. This also leaves the employee with no record of the attempt, making them more susceptible to a follow-up method that bypasses email. Ignoring a suspected attack never contains it; only reporting enables the organization to detect and block further attempts.

Go deeper

Related to this question